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A  Summary  of  Unmanned  Aircraft  Accident/Incident  Data; 
Human  Factors  Implications 


INTRODUCTION 

Available  reports  regarding  unmanned  aircraft  (UA) 
reliability  have  noted  that  the  accident  rate  for  UA  is,  in 
general,  much  higher  than  that  of  manned  aircraft  (DoD, 
200 1 ;  Schaefer,  2003;Tvaryanas,  2004) .  An  understand¬ 
ing  of  the  causal  factors  associated  with  these  accidents  is 
important  if  the  goal  is  to  improve  the  reliability  of  these 
aircraft  to  a  level  comparable  to  manned  aircraft. 

Human  factors  are  consistently  cited  as  a  major  cause 
of  manned  aircraft  accidents.  Estimates  of  the  percentage 
of  accidents  that  implicate  human  error  range  from  70% 
to  80%  (Wiegmann  &  Shappell,  2003).  In  addition,  over 
the  past  40  years,  the  percentage  of  accidents  attributable 
to  human  error  has  increased  relative  to  those  attributable 
to  equipment  failures  (Shappell  &  Weigmann,  2000). 

The  review  and  analysis  of  UA  accident  data  can 
assist  researchers  in  the  identification  of  important  hu¬ 
man  factors  issues  related  to  their  use.  The  most  reliable 
source  for  UA  accident  data  currently  is  the  military. 
The  military  has  a  relatively  long  history  of  UA  use  and 
is  diligent  in  accurately  recording  information  pertaining 
to  accidents/incidents.  The  purpose  of  this  report  is  to 
review  all  currently  available  information  on  military  UA 
accidents  to  determine  to  what  extent  human  error  has 
contributed  to  those  accidents  and  to  identify  specific 
human  factors  involved  in  the  accidents. 


Nomenclature 

Designations  for  unmanned  aircraft  are  almost  as  var¬ 
ied  as  the  aircraft  themselves.  The  most  common  term 
for  these  aircraft  is  Unmanned  Aerial  Vehicle  (UAV). 
They  have  also  been  called  Uninhabited  Aerial  Vehicles 
(also  UAVs),  Remotely  Operated  Vehicles  (ROVs),  and 
Remotely  Piloted  Vehicles  (RPVs) .  In  addition,  the  mili¬ 
tary  has  some  special  categories  of  unmanned  aircraft 
that  require  additional  nomenclature.  These  categories 
include  Tactical  UAVs  (TUAV) ,  Combat  UAVs  (UCAV) , 
Unmanned  Combat  Armed  Rotorcraft  (UCAR),  and 
“drones.”  Some  agencies  have  problems  with  the  use 
of  the  term  “vehicle”  for  aircraft.  So  there  also  exist 
designations  like  Remotely  Operated  Aircraft  (ROA), 
Robotic  Aircraft  (RA),  Remotely  Piloted  Aircraft  (RPA), 
and  Unmanned  Aircraft  (UA).  The  term  “Unmanned 
Aircraft”  (UA)  will  be  used  in  this  paper  to  designate  the 
large  population  of  remotely  piloted,  operated,  and/or 
monitored  aircraft. 

Military  Accident  Classification  System 

Military  accidents  are  classified  based  on  mon¬ 
etary  damage  and/ or  severity  of  injury  to  personnel. 
All  military  branches  have  similar  accident  classifica¬ 
tion  schemes.  The  most  severe  accident  classifica¬ 
tion  is  Class  A.  Table  1  shows  the  accident  classes 
for  the  Army. 


Table  1.  Army  accident  classes  (Department  of  the  Army,  1994a). 


Class  A 

Class  B 

Class  C 

Class  D 

An  accident  in  which 
the  resulting  total  cost  of 
property  damage  is 
$1,000,000  or  more;  an 
Army  aircraft  or  missile 
is  destroyed,  missing,  or 
abandoned;  or  an  injury 
and/or  occupational 
illness  results  in  a 
fatality  or  permanent 
total  disability. 

An  accident  in  which 
the  resulting  total  cost  of 
property  damage  is 
$200,000  or  more  but 
less  than  $  1 ,000,000;  an 
injury  and/or 
occupational  illness 
results  in  permanent 
partial  disability,  or 
when  three  or  more 
personnel  are 
hospitalized  as 
inpatients  as  the  result 
of  a  single  occurrence. 

An  accident  in  which 
the  resulting  total  cost  of 
property  damage  is 
$20,000  or  more  but  less 
than  $200,000;  a 
nonfatal  injury  that 
causes  any  loss  of  time 
from  work  beyond  the 
day  or  shift  on  which  it 
occurred;  or  a  nonfatal 
occupational  illness  that 
causes  loss  of  time  from 
work  or  disability  at  any 
time. 

An  accident  in  which 
the  resulting  total  cost  of 
property  damage  is 
$2,000  or  more  but  less 
than  $20,000. 
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The  Air  Force  and  Navy  definitions  of  Class  A,  B, 
and  C  accidents  are  very  similar  to  the  Army  defini¬ 
tions.  However,  both  the  Navy  and  Air  Force  classify 
their  mishaps/ accidents  into  only  the  three  categories  of 
A,  B,  and  C.  They  do  not  have  a  category  D. 

Data  Sources 

To  collect  UA  accident  data,  personnel  from  the  Safety 
Centers  oftheArmy,  Navy,  andAir  Force  were  contacted. 
Requests  were  made  for  all  data  related  to  UA  accidents, 
mishaps,  and  incidents  from  each  of  the  Safety  Centers. 
Personnel  from  military  research  laboratories  were  also 
contacted  for  information  and  reports  summarizing  ac¬ 
cident  data.  In  addition,  an  Internet  search  was  conducted 
to  identify  and  download  accident  information. 

Army  Data 

Two  primary  sources  of  accident  information  were 
collected  from  the  Army.  The  first  source  was  a  report 
entitled  “The  Role  of  Human  Causal  Factors  in  U.S. 
Army  Unmanned  Aerial  Vehicle  Accidents”  (Manning, 
Rash,  LeDuc,  Noback,  &  McKeon,  2004).  The  report 
was  produced  by  the  U.S.  Army  Aeromedical  Research 
Laboratory  and  is  a  summary  of  56  UA  accidents  that 
occurred  between  January  1995  and  February  2003.  The 
accident  data  were  obtained  from  the  U.S.  Army  Risk 
Management  Information  System  (RMIS),  maintained 
by  the  U.S.  Army  Safety  Center  (USASC),  Fort  Rucker, 
Alabama.  The  accidents  were  summarized  using  two 
taxonomies,  a  modified  version  of  the  Human  Factors 
Analysis  and  Classification  System  (HFACS;  Shappell  & 
Weigmann,  2000),  and  the  Army  accident  investigation 
and  reporting  taxonomy,  DA  PAM  385-40  (Department 
oftheArmy,  1994b). 

The  second  source  of  information  was  a  direct  query  of 
the  RMIS  system.  The  query  examined  all  UA  accidents 
contained  in  the  RMIS  database  that  occurred  between 
January  1980  and  June  2004.  A  total  of  74  accidents 
were  identified,  the  earliest  of  which  occurred  on  March 
2,  1989,  and  the  latest  on  April  30,  2004. 

Navy  Data 

Information  regarding  UA  accidents  for  the  Navy 
was  collected  from  the  Naval  Safety  Center.  A  summary 
of  UA  mishaps  occurring  between  1986  and  2002  was 
received  from  the  Naval  UA  Pioneer  training  command 
in  Pensacola,  Florida,  via  the  Naval  Safety  Center  (Kor- 
deen  Kor,  personal  communication).  The  summary  lists 
239  mishaps,  including  the  mishap  level,  date,  location, 
and  a  brief  description.  The  brief  description,  while  not 
providing  much  detail,  allowed  the  general  classification 
of  the  mishap,  including  whether  the  mishap  was  or  was 
not  related  to  human  factors. 


Air  Force  Data 

Air  Force  accident/mishap  information  was  collected 
from  the  Air  Force  Judge  Advocate  General’s  Corps 
Web  site,  http://usaf.aib. law.afmil/.  The  Web  site  gives 
the  executive  summaries  of  Air  Force  Class  A  mishaps, 
organized  by  year.  Lower-level  mishaps  were  not  avail¬ 
able.  A  total  of  1 5  Class  A  UA  mishaps  were  retrieved 
from  the  Web  site,  covering  the  dates  from  December 
6,  1999,  to  December  11,  2003.  In  addition  to  these 
executive  summaries,  a  complete  accident  investigation 
board  report  of  the  December  6,  1999,  accident  was 
received  electronically  from  Major  Curtis  McNeil  of  the 
Judge  Advocate  General’s  Corps  office.  Also,  a  summary 
of  Air  Force  accidents  and  human  factors  issues  related 
to  UA  was  received  electronically  from  Major  Anthony 
P  Tvaryanas  (Tvaryanas,  2004). 

Data  Reliability  Issues 

Unfortunately,  the  data  regarding  UA  accidents  are  not 
usually  as  detailed  as  that  surrounding  manned  aircraft. 
One  reason  for  this  lack  of  detail  is  that  most  UA  used 
in  the  military  are  much  less  expensive  than  manned 
aircraft  and  so  do  not  warrant  the  same  level  of  analysis. 
In  addition,  the  military  does  not  release  much  of  the 
detailed  information  regarding  specific  UA  accidents  to 
the  general  public. 

There  are  also  problems  regarding  the  classification  of 
UA  in  the  military.  The  Army,  for  example,  only  recently 
has  begun  to  classify  UA  as  aircraft.  Before,  they  were 
classified  only  as  vehicles.  Therefore,  accidents  involving 
Army  UA  were  treated  in  the  same  fashion  as  ground 
vehicles.  A  similar  situation  existed  until  recently  for 
the  Navy.  In  effect,  there  are  really  no  highly  detailed 
accident  investigations  performed  for  UA  accidents,  with 
the  exception  of  the  Air  Force.  The  Air  Force,  however, 
will  not  release  detailed  reports  to  the  general  public  and 
puts  restrictions  on  the  writing  of  reports  based  on  such 
detailed  data.  Consequently,  much  of  the  reported  ac¬ 
cident  data  collected  for  this  report  consists  of  summaries 
of  several  accidents  or  simple  one-sentence  statements 
regarding  individual  accidents. 

Classification  Procedure 

Classification  of  the  accident  data  was  a  two-step 
process.  In  the  first  step,  accidents  were  classified  into 
broad  categories  based  on  whether  it  was  clear  the  ac¬ 
cident  was  related  to  human  factors  or  was  a  failure  of 
an  aircraft  component.  For  some  aircraft  systems,  other 
categories  were  included  based  on  information  specific  to 
that  aircraft.  The  category  “Aircraft”  included  problems 
associated  with  the  failure  of  a  mechanical  or  electrical 
component  of  the  airframe.  An  “Unknown”  category  was 
used  if  there  were  accidents  with  insufficient  information 


2 


for  categorization.  A  category  of  “Maintenance”  was  also 
included  if  there  was  evidence  that  an  action  by  mainte¬ 
nance  personnel  contributed  to  the  accident.  An  example 
would  be  a  failure  by  a  maintenance  technician  to  check 
the  oil  level  prior  to  a  flight,  leading  to  an  engine  failure 
during  the  flight.  This  category  was  separated  from  hu¬ 
man  factors  because  it  did  not  involve  a  member  of  the 
flight  crew  and  because  UA  maintenance  is  an  important 
topic  by  itself  that  should  be  addressed  separately.  Note 
that  accidents  could  be  classifled  into  more  than  one 
category.  For  example,  an  accident  could  be  classifled 
as  both  “Aircraft”  and  “Human  Factors”  if  a  mechani¬ 
cal  failure  was  also  accompanied  by  an  inappropriate  or 
inadequate  display  indication  to  the  crew. 

In  the  second  step,  those  accidents  classifled  as  related 
to  human  factors  were  classifled  according  to  speciflc 
human  factors  issues  that  are  commonly  addressed  in 
current  research.  These  issues  included  alerts/alarms, 
display  design  deflciencies,  procedural  errors,  and  skill- 
based  errors.  Other  human  factors  issues  were  included 
for  a  particular  aircraft  if  evidence  was  available  from 
the  reports  indicating  it  was  an  important  factor  in  the 
accident.  Classiflcation  was  based  on  the  stated  causal  fac¬ 
tors  in  the  reports,  the  expressed  opinion  of  safety  center 
personnel,  and  the  personal  judgment  of  the  author. 

RESULTS 

Because  of  the  enormous  differences  in  the  human 
interfaces  of  the  various  UA  systems,  it  did  not  make  sense 
to  combine  all  of  the  accident  data  into  a  single  analysis. 
Instead,  each  system  will  be  looked  at  individually  to  see 
how  their  design  approaches  have  influenced  the  types 
of  human  errors  that  have  occurred. 

There  are  five  primary  U.S.  military  UA  in  service 
currently.  The  Army’s  Hunter  and  Shadow,  the  Navy’s 
Pioneer,  and  the  Air  Force’s  Predator  and  Global  Hawk. 
Other  systems  are  being  developed  and  have  undergone 
testing,  such  as  the  Mariner  system  for  the  Coast  Guard 
and  Navy,  but  sufficient  accident  data  do  not  exist  to 
warrant  separate  analyses  of  these  airframes.  A  descrip¬ 
tion  of  these  five  UA  systems  included  in  this  analysis 
is  provided  in  an  effort  to  further  understanding  of  the 
accident  data  associated  with  each. 

U.S.  Army 

Human  Causal  Factors  Report 

Manning  et  al.  (2004)  looked  at  Army  UA  accident 
data  using  both  the  HFACS  taxonomy  and  the  DA  PAM 
385-40  analysis.  A  total  of  56  UA  accidents  were  analyzed, 
with  1 8  (32%)  identified  as  involving  human  error.  They 
did  not  perform  an  analysis  separately  for  the  Hunter 
and  Shadow  UA;  however,  they  noted  that  17  accidents 


involved  the  Hunter  and  10  involved  the  Shadow,  but 
the  report  does  not  state  how  many  of  those  involved 
human  error.  In  addition,  accident  data  were  included 
in  the  analysis  even  if  the  UA  type  was  only  identified  as 
a  “drone,”  “trainer,”  or  simply  “UAV.” 

Regarding  the  HFACS  analysis,  the  largest  percentage 
of  accidents  involving  human  error  (6 1  %)  was  attributed 
to  the  category  called  Unsafe  Acts.  Unsafe  Acts  is  broken 
down  further  into  the  subcategories  of  skill-based  errors, 
decision  errors,  perceptual  errors,  and  violations.  Decision 
errors  accounted  for  the  highest  percentage  of  human  error 
accidents  (33%),  followed  by  skill-based  errors  (22%), 
perceptual  errors  (17%),  and  violations  (11%). 

The  DA  PAM  385-40  analysis  divides  accidents  into 
the  categories  of  individual  failure,  leader  failure,  train¬ 
ing  failure,  support  failure,  and  standards  failure.  For 
definitions  of  these  categories  the  reader  is  referred  to 
DA  PAM  385-40.  Sixty-one  percent  of  the  human-error 
accidents  were  attributed  to  individual  failures,  followed 
by  standards  failures  (44%),  leader  failures  (33%),  train¬ 
ing  failures  (22%),  and  finally  support  failures  (6%).  The 
percentages  do  not  add  to  100%  because  many  of  the 
accidents  fell  into  more  than  one  category. 

One  shortcoming  of  the  summary  by  Manning  et  al.  is 
that  the  analysis  does  not  identify  specific  human  factors 
issues  associated  with  UA  accidents .  The  use  of  the  HFAGS 
taxonomy  helped  in  the  identification  of  the  importance 
of  decision-making  and  the  development  of  crew  skills 
in  the  prevention  of  accidents  but  did  not  reveal  specific 
design  shortcomings  of  the  various  systems  included  in 
the  data.  For  this  reason,  a  second  analysis  was  conducted 
of  the  accidents  contained  in  the  RMIS  database.  This 
analysis  examined  74  UA  accidents  that  occurred  between 
March  2,  1989,  and  April  30,  2004. 

These  74  accidents  were  separated  into  those  related 
specifically  to  the  Hunter  (32  accidents),  those  involving 
the  Shadow  (24  accidents),  and  those  concerning  other 
types  of  UA  (18  accidents).  The  Hunter  and  Shadow 
accidents  were  further  analyzed  to  identify  how  many 
involved  human  factors  issues  and  which  issues  were 
associated  with  a  specific  type  of  aircraft. 

Hunter 

The  Hunter  (see  Figure  1)  is  a  twin-engine,  short-range 
(I44nm)  tactical  aircraft,  with  a  payload  capacity  of  200 
pounds  and  endurance  of  up  to  12  hours  (Manning  etal., 
2004).  The  aircraft  weighs  1600  pounds  and  has  a  29- 
foot  wingspan,  a  ceiling  of  15,000  feet,  a  cruising  speed 
of  100  kts  and  a  cost  of  $1.2M  (Schaefer,  2003). 

The  Hunter  takes  off  and  lands  using  an  External  Pilot 
(EP)  standing  next  to  the  runway  in  visual  contact  with  the 
aircraft,  operating  a  controller  that  is  very  similar  to  ones  used 
by  radio-controlled  aircraft  hobbyists  (see  Figure  2). 
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Figure  1 .  U.S.  Army  Hunter  (RQ-5)  unmanned 
aircraft. 


Figure  2.  Controller  for  radio-controlled  aircraft. 


As  shown  in  Figure  1,  takeoffs  can  be  assisted  using 
a  rocket  bottle  that  releases  from  the  aircraft  shortly  af¬ 
ter  takeoff  After  takeoff  and  climb  out,  control  of  the 
aircraft  is  transferred  to  an  Internal  Pilot  (IP),  operating 
from  a  Ground  Control  Station  (GCS).  The  IP  controls 
the  Hunter  in  a  more  automated  fashion  by  selecting  an 
altitude,  heading,  and  airspeed  for  the  aircraft  using  a  set 
of  knobs  located  within  the  GCS.  For  landing,  control 
of  the  aircraft  is  transferred  from  the  GCS  back  to  an 
EP.  A  hook  located  below  the  aircraft  is  used  to  snag  the 
aircraft  on  a  set  of  arresting  cables  positioned  across  the 
runway. 


Data  from  the  Hunter  program  indicated  that  1 5  of  the 
32  accidents  (47%)  had  one  or  more  human  factors  issues 
associated  with  them.  Figure  3  shows  the  major  causal 
categories  for  Hunter  accidents.  Note  that  the  percentages 
add  to  more  than  100%  because  some  of  the  accidents 
were  classified  into  more  than  one  category. 

Breaking  down  the  human  factors  issues  further.  Table 
2  shows  how  the  number  and  percentage  of  the  1 5  hu¬ 
man  factors-related  accidents  are  associated  with  specific 
human  factors  issues.  Again,  percentages  exceed  100% 
because  of  some  accidents  being  classified  under  more 
than  one  issue. 

By  far  the  largest  human  factors  issue  is  the  difficulty 
experienced  by  EPs  during  landings,  with  47%  of  the 
human  factors-related  Hunter  accidents  occurring  during 
this  phase.  An  additional  20%  of  the  accidents  involved 
an  error  by  the  EP  during  takeoff  Gontrol  difficulties 
are  at  least  partially  caused  because  when  the  aircraft 
is  approaching  the  EP,  the  control  inputs  to  maneuver 
the  aircraft  left  and  right  are  opposite  what  they  would 
be  when  the  aircraft  is  moving  away  from  the  EP  This 
reversed-control  problem  is  present  for  any  UA  operated 
by  an  external  pilot  via  visual  contact.  Other  research 
has  also  identified  this  problem  as  an  important  human 
factors  issue  related  to  UA  (Gawron,  1998). 

Besides  EP  control  problems,  other  issues  represented 
in  the  table  include  pilot-in-command  issues,  alerts  and 
alarms,  display  design,  and  crew  procedural  error.  A  pi- 
lot-in-command  issue  is  a  situation  where  the  authority 
of  the  controlling  pilot  is  superceded  by  other  personnel 
in  the  area,  violating  the  principle  that  the  pilot  of  the 
aircraft  has  the  final  decision-making  authority  during  a 
flight.  In  contrast,  alerts  and  alarms  deal  with  situations 
where  a  non-normal  flight  condition  (e.g.,  high  engine 
temperature)  is  not  conveyed  effectively  to  the  crew. 

Display  design  issues  typically  manifest  when  not  all 
of  the  information  required  for  safe  flight  is  conveyed 
effectively  to  the  crew.  In  the  instance  referred  to  in  Table 
2,  a  ground  crew  member  had  toggled  off  the  autopilot 
feature,  and  no  display  was  available  to  the  flight  crew 
regarding  the  status  of  the  autopilot.  Since  the  autopilot 
is  typically  engaged  when  the  IP  is  controlling  the  UA, 
the  pilot  failed  to  notice  the  status  of  the  autopilot,  thus 
contributing  to  an  accident. 

Finally,  the  crew  procedural  errors  referred  to  here 
involved  three  occasions  where  the  crew  failed  to  prop¬ 
erly  follow  established  procedures.  On  one  occasion  an 
improper  start-up  sequence  led  to  data  link  interference 
from  the  backup  GGS.  A  second  event  occurred  when 
the  crew  failed  to  follow  standard  departure  procedures 
and  the  UA  impacted  a  mountain.  The  third  occasion 
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Figure  3.  U.S.  Army  Hunter  accident  causal  factors. 


Table  2.  Breakdown  of  human  factors  issues  for  Hunter 
accidents. 


Issue 

Number 

Percent 

Pilot-In-Command 

1 

7% 

Alerts  and  Alarms 

2 

13% 

Display  Design 

1 

7% 

External  Pilot  Landing  Error 

7 

47% 

External  Pilot  Takeoff  Error 

3 

20% 

Procedural  Error 

3 

20% 

was  when  an  EP  failed  to  complete  control  box  checks 
prior  to  taking  control  of  the  UA  and  did  not  verify  a 
box  switch  that  was  in  the  wrong  position. 

Shadow 

Compared  with  the  Hunter,  the  Shadow  200  (Figure 
4)  is  a  smaller  (9  ft  in  length),  and  lighter  (330  lbs) 
short-range  surveillance  aircraft,  capable  of  operating  at 
altitudes  of  14,000  ft  and  carrying  a  payload  of  up  to 
60  lbs  (Manning  et  al.,  2004).  The  Shadow  200  has  an 
operational  range  of  68nm,  a  cruising  speed  of  82  kts  and 
a  cost  of  $325,000  per  aircraft  (Schaefer,  2003). 

Unlike  the  Hunter,  the  Shadow  does  not  use  an  external 
pilot,  depending  instead  on  a  launcher  for  takeoffs  and 
an  automated  landing  system  for  recovery.  The  landing 
system,  called  the  Tactical  Automated  Landing  System 
(TALS),  controls  the  aircraft  during  approach  and  land¬ 
ing,  usually  without  intervention  from  the  CCS  pilot. 
A  cable  system,  similar  to  the  one  used  for  the  Hunter, 
is  used  to  stop  the  aircraft  after  landing.  Aircraft  control 
during  flight  is  accomplished  by  the  CCS  pilot  through 


a  computer  menu  interface  that  allows  selection  of  al¬ 
titude,  heading,  and  airspeed.  It  is  interesting  to  note 
that  during  landing,  the  CCS  personnel  have  no  visual 
contact  with  the  aircraft,  nor  do  they  have  any  sensor 
input  from  onboard  sensors.  A  command  to  stop  the 
aircraft  engine  is  given  by  the  GCS  pilot,  who  must  rely 
on  an  external  observer  to  communicate  that  the  plane 
has  touched  down. 

The  analysis  of  Shadow  accidents  shows  a  different 
pattern  from  that  seen  with  the  Hunter.  In  contrast  to 
the  Hunter,  only  5  of  the  24  Shadow  accidents  (21%) 
were  attributed  to  human  factors  issues.  Figure  5  shows 
the  major  causal  factors  for  the  Shadow  accidents. 

In  addition  to  the  four  categories  used  for  the  Hunter 
accidents,  an  additional  category  was  added  for  Shadow 
to  include  failures  of  the  tactical  automated  landing 
system.  While  eliminating  landing  accidents  potentially 
attributable  to  an  EP,  the  use  of  TALS  is  not  perfect,  as 
shown  from  the  data.  Use  of  the  launcher  eliminated  any 
EP  takeoff  errors  for  these  aircraft. 
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Figure  4.  U.S.  Army  Shadow  (RQ-7)  unmanned 
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Figure  5.  U.S.  Army  Shadow  accident  causal  factors. 


Table  3.  Breakdown  of  human  factors  issues  for 
Shadow  accidents. 


Issue 

Number 

Percent 

Pilot-In-Command 

2 

40% 

Alerts  &  Alarms 

2 

40% 

Display  Design 

2 

40% 

Procedural  Error 

2 

40% 
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Breaking  down  the  human  factors-related  accidents, 
Table  3  shows  the  number  and  percentage  of  the  five 
accidents  related  to  specific  human  factors  issues.  As  can 
be  seen  from  the  table,  the  distribution  of  issues  is  evenly 
divided  across  pilot-in-command,  alerts  and  alarms,  dis¬ 
play  design,  and  procedural  errors. 

For  both  the  Hunter  and  Shadow,  at  least  one  accident 
involved  the  transfer  of  control  of  the  aircraft  from  one 
GCS  to  another  during  flight,  an  activity  unique  to  UA. 
In  the  case  of  the  Shadow,  two  aircraft  were  damaged 
during  a  single  mission.  The  first  was  damaged  due  to  a 
TALS  failure.  After  the  accident,  the  GCS  crew  issued 
a  command  to  the  damaged  aircraft  to  kill  its  engine, 
but  because  of  damage  to  the  antenna  the  command 
was  not  received.  That  same  GCS  was  then  tasked  with 
controlling  a  second  Shadow  that  was  on  an  approach. 
Unfortunately,  after  taking  control  of  the  second  Shadow, 
the  aircraft  received  the  “engine  kill”  command  that  was 
still  waiting  for  an  acknowledgment  from  the  GCS  soft¬ 
ware,  causing  the  second  Shadow  to  also  crash.  This  ac¬ 
cident  was  classified  as  both  a  procedural  error  (because 
the  crew  failed  to  follow  all  checklist  items  prior  to  the 
transfer  of  control  of  the  second  aircraft)  and  a  display 
design  problem  (because  there  was  not  a  clear  indication 
to  the  crew  of  the  status  of  the  “engine  kill”  command 
that  had  been  issued). 

While  not  frequent,  such  accidents  suggest  the  unique 
nature  of  problems  that  can  arise  with  UA  that  would  not 
be  encountered  with  manned  aircraft.  As  if  to  emphasize 
the  point,  on  a  recent  Goast  Guard  operational  test  of 
an  Altair  UA,  a  problem  was  encountered  during  one  of 
the  flights  while  control  was  being  transferred  from  one 
operator  station  to  another  (Randy  Sundberg,  personal 
communication) .  The  second  operator  station  apparently 
had  a  fuel  control  switch  out  of  position,  so  that  when 
control  was  passed  over,  the  engine  died.  Luckily,  in  this 
instance,  the  aircraft  was  high  enough  that  the  engine 
was  restarted  without  incident. 

U.S.  Navy 

Pioneer 

The  longest  serving  UA  in  the  military  is  the  Pioneer 
(RQ-2),  which  has  been  used  by  the  Navy  and  Marine 
Gorps  since  1985  and  has  logged  over  20,000  hours  of 
flight  time  (Schaefer,  2003).  The  Pioneer  (see  Figure  6) 
is  a  single-engine,  propeller-driven  aircraft.  It  is  14  ft 
long  with  a  wingspan  of  17  ft.  It  weighs  452  lbs  and  has 
a  payload  capacity  of  72  lbs.  It  can  fly  for  5  hrs  without 
refueling,  has  a  ceiling  of  15,000  ft,  and  a  cruising  speed 
of  80  kts.  Each  aircraft  costs  $650,000.  Notably,  in  Sep¬ 
tember  2002,  the  Navy  discontinued  operation  of  the 
Pioneer,  leaving  the  Marine  Gorps  as  the  only  operator. 


Figure  6.  Pioneer  RQ-2  unmanned  aircraft. 


Like  the  Army’s  Hunter  UA,  the  Pioneer  requires  an 
EP  for  takeoff  and  landing.  After  takeoff,  the  aircraft 
can  be  controlled  from  a  GGS  in  one  of  three  modes.  In 
the  first  mode,  the  air  vehicle  is  operated  autonomously, 
and  the  autopilot  uses  global  positioning  system  (GPS) 
preprogrammed  coordinates  to  fly  it  to  each  waypoint. 
In  the  second  mode,  the  IP  commands  the  autopilot  by 
setting  knobs  (rotary  position  switches)  to  command 
airspeed,  altitude,  compass  heading  or  roll  angle,  and 
the  autopilot  flies  the  UA.  In  the  third  mode,  the  IP 
flies  the  aircraft  using  a  joystick.  The  Pioneer  can  be 
landed  at  a  runway  using  arresting  cables,  but  because  it 
is  a  Navy/Marine-operated  aircraft,  it  can  also  be  landed 
on  board  a  ship  by  flying  into  a  net.  There  are  plans 
for  implementing  an  automated  landing  system  for  the 
Pioneer  for  ship-based  landings. 

A  list  of  239  Pioneer  accidents  was  received  from  the 
Navy  Safety  Genter.  The  accidents  cover  the  period  from 
1986  until  2002.  Although  not  providing  much  detail, 
the  data  did  allow  a  general  categorization  of  accidents 
into  principal  causal  categories.  Figure  7  shows  the  major 
causal  factors  for  Pioneer  accidents. 

As  can  be  seen  from  the  figure,  human  factors-related 
issues  were  present  in  approximately  28%  of  the  accidents. 
Also,  a  small  number  of  mishaps  (5)  were  attributed  to 
enemy  actions.  Breaking  down  the  human  factors-related 
accidents  further.  Table  4  lists  the  number  and  percent¬ 
age  of  the  68  accidents  related  to  specific  human  factors 
issues. 

As  with  the  Army  Hunter  accidents,  the  largest  per¬ 
centage  of  human  factors  accidents  (68%)  was  associated 
with  the  difficulty  experienced  by  the  EP  while  landing 
the  aircraft.  An  additional  10%  of  the  accidents  were 
associated  with  takeoffs,  although  the  primary  means 
of  taking  off  is  through  the  use  of  a  launcher  (from 
ship-based  aircraft).  In  addition  to  landing  and  takeoff 
errors,  two  other  issues  seen  with  the  Pioneer  were  aircrew 
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Figure  7.  U.S.  Navy  Pioneer  UA  accident  causal  factors. 


Table  4.  Breakdown  of  human  factors  issues  for 
Pioneer  accidents. 


Issue 

Number 

Perceut 

Aircrew  Coordination 

9 

13% 

Landing  Error 

46 

68% 

Take-off  Error 

7 

10% 

Weather 

6 

9% 

Table  5.  Specifications  for  the  Air  Force  MQ-1  and  MQ-9 
(from  Schaefer,  2003). 


MQ-1 

MQ-9 

Gross  Weight 

2,250  lbs 

10,000  lbs 

Length 

28.7  ft 

36.2  ft. 

Wingspan 

48.7  ft 

64  ft 

Ceiling 

25,000  ft 

45,000  ft 

Radius 

400  nm 

400  nm 

Endurance 

24  -t  hrs 

24  -t  hrs 

Payload 

4501b 

750  lb  (internal) 
3000  lb  (external) 

Cruise  Speed 

70  kts 

220  kts 

Aircraft  cost  (w/out  sensors) 

$2.4  M 

$6M 

System  Cost  (4  Avs) 

$26.5  M 

$47  M 

Figure  8.  The  U.S.  Navy  Fire  Scout  (RQ-8A). 


Figure  9.  Predator  MQ-1. 


Figure  10.  Predator  B  MQ-9. 


coordination,  which  includes  procedural  and  communi¬ 
cation  type  errors,  and  weather-related  accidents,  which 
deal  with  pilot  decision-making.  Unfortunately,  details 
regarding  these  accidents  were  not  sufficient  to  identify 
issues  beyond  this  level. 

Fire  Scout 

An  additional  accident  for  which  information  was  avail¬ 
able  was  the  crash  of  a  Navy-owned  Vertical  Take-off  and 
Landing  Tactical  Unmanned  Aerial  Vehicle  (VTUAV), 
called  the  Fire  Scout  (see  Figure  8). 

The  Fire  Scout  air  vehicle  (RQ-8A)  is  based  on  the 
Schweizer  Aircraft  Corporation  Model  330  manned  tur¬ 
bine  helicopter.  The  Fire  Scout  has  a  gross  takeoff  weight 
of  2,550  lbs,  cruises  at  1 10  kts,  and  is  intended  to  loiter 
on-station  at  1 10  nm  for  over  3  hrs  (DoD,  2002). 

The  investigation  of  the  accident,  which  occurred  on 
November  4,  2000,  revealed  that  human  error,  associ¬ 
ated  with  damage  to  onboard  antennas  during  ground 
handling,  led  to  the  accident.  Because  of  the  damage 
to  the  antennas,  an  incorrect  signal  was  emitted,  caus¬ 
ing  the  radar  altimeter  system  to  incorrectly  track  the 
altitude.  The  antennas  gave  a  false  reading  that  indicated 


that  the  Fire  Scout  was  at  an  altitude  of  2  ft  above  the 
ground  when,  in  fact,  it  was  hovering  at  an  altitude  of 
500  ft  (Strikenet,  2001).  After  the  “land”  command  was 
given,  the  aircraft  descended  two  ft  to  498  ft  AGL.  The 
guidance  and  control  system  interpreted  the  incorrect 
altitude  signal  as  an  indication  that  the  Fire  Scout  had 
already  landed  and,  performing  as  designed,  shut  down 
the  engine.  Although  the  Fire  Scout  is  not  widely  used, 
the  accident  is  included  here  because  it  is  another  example 
of  how  unique  approaches  to  automation  and  procedures 
with  UA  can  lead  to  unique  mishaps. 

Air  Force 

Predator 

The  Predator  made  its  first  flight  in  June  1994.  There 
are  two  Predator  types,  currently  designated  as  MQ- 1  and 
MQ-9,  also  called  Predator  and  Predator  B.  Figures  9  and 
10  show  photos  of  the  MQ-1  and  MQ-9,  respectively. 

The  specifications  for  both  the  MQ- 1  and  MQ-9  are 
presented  in  Table  5.  The  Predator  aircraft  is  flown  from 
within  the  CCS,  similarly  to  a  manned  aircraft,  using  a 
joystick  and  rudder  pedals  and  a  forward-looking  camera 
that  provides  the  pilot  with  a  30-degree  held  of  view.  The 
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Figure  11.  Predator  ground  control  station  layout. 


Table  6.  Breakdown  of  human  factors  issues  for 
Predator  accidents. 


Issue 

Number 

Percent 

Alerts  &  Alarms 

1 

13% 

Display  Design 

2 

25% 

Landing  Error 

1 

13% 

Procedural  Error 

6 

75% 

67% 


Figure  12.  Air  Force  Predator  accident  causal  factors. 


camera  is  used  for  both  takeoffs  and  landings.  Figure  1 1 
shows  a  picture  of  the  Predator  GCS. 

The  Predator  accident  causal  factors  are  shown  in  Fig¬ 
ure  12.  As  can  be  seen  from  the  figure,  human  factors 
encompass  a  higher  percentage  (67%)  than  aircraft- related 
causes,  unlike  the  other  aircraft  examined  thus  far. 

Table  6  shows  a  breakdown  of  the  human  factors  is¬ 
sues  associated  with  Predator  accidents.  The  majority  of 
human  factors-related  problems  were  concerned  with 
procedural  errors  on  the  part  of  the  flight  crew.  One 
of  these  accidents  involved  yet  another  problem  with  a 
handoff  of  the  aircraft  from  one  GCS  to  another.  During 
the  handoff,  the  mishap  crew  did  not  accomplish  all  of 
the  checklist  steps  in  the  proper  order,  resulting  in  turn¬ 
ing  off  both  the  engine  and  the  stability  augmentation 
system  of  the  aircraft.  The  aircraft  immediately  entered 
an  uncommanded  dive  and  crashed. 


A  second  procedural  error  of  note  occurred  when  the 
pilot  accidentally  activated  a  program  that  erased  the 
internal  random  access  memory  onboard  the  aircraft 
during  a  flight.  That  this  was  even  possible  to  do  during 
a  flight  is  notable  in  itself  and  suggests  the  relatively  ad 
hoc  software  development  process  occurring  for  these 
systems  (Tvaryanas,  2004).  Predator  pilots  also  have 
noted  problems  caused  by  the  software  interface  (Hoff¬ 
man,  2004).  One  example  in  particular  from  Hoffman 
(2004)  was  with  the  assignment  of  menu  selections  to 
function  keys  on  the  GGS  keyboard.  Hoffman  noted  that 
a  particular  order  of  pressing  function  keys  that  controlled 
the  lights  on  the  Predator  was  almost  the  same  as  an  order 
for  cutting  off  the  engine. 

The  report  byTvaryanas  (2004)  on  mishap  epidemiol¬ 
ogy  states  that  Human  System  Interface  (HSI)  issues  are 
discussed  in  89%  of  the  Predator  accidents  and  are  cited 
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as  a  causal  factor  in  44%  of  those  accidents.  Tvaryanas 
cites  four  HSI  issues  involved  with  Predator  mishaps: 
1)  design  of  the  head-up  display  (HUD);  2)  design  of 
the  head-down  display  (HDD);  3)  alerts  and  alarms 
(Tvaryanas  calls  them  “warnings  and  cautions”);  and  4) 
functioning  of  the  autopilot. 

Specific  problems  cited  for  the  HUD  design  are  that 
the  field  of  view  (30  degrees)  is  too  narrow,  the  attitude 
indicator  is  inadequate,  the  engine  RPM  indicator  needs 
improvement,  the  symbology  becomes  obscured  during 
low-link  conditions,  some  of  the  symbology  lacks  sufficient 
contrast  against  the  external  view,  and  other  symbology 
is  inadequate.  There  is  currently  an  effort  to  replace  the 
Predator  HUD  with  a  new  design  based  on  fighter  aircraft 
HUD  designs.  However,  even  the  new  HUD  design  does 
not  address  all  of  the  problems  listed  above. 

Four  specific  problems  were  cited  for  head-down  dis¬ 
play  design.  These  were:  1)  too  many  levels  of  pages  to 
maneuver  through  to  access  information;  2)  the  unintui¬ 
tive  manner  of  information  display;  3)  critical  commands 
were  unprotected  or  unemphasized;  and  4)  operational 
ranges  of  values  were  inconsistent  within  the  display.  The 
lack  of  protection  for  critical  commands  was  a  key  feature 
in  the  mishap  cited  above  where  the  internal  memory  of 
the  aircraft  was  erased  during  a  flight. 

The  following  deficiencies  of  alerts  and  alarms  were 
noted:  1)  alerts  do  not  command  attention;  2)  audio  warn¬ 
ings  were  insufficient  or  absent;  3)  information  provided 
was  inadequate  or  poorly  prioritized;  4)  information  was 
invalid;  and  5)  data  that  need  to  be  compared  are  not 
always  co-located  on  the  same  display  page.  Tvaryanas  also 
states  that  the  alerts  and  alarms  on  the  Predator  violate 
multiple  human  factors  design  principles. 

Finally,  four  problems  were  cited  byTvaryanas  regard¬ 
ing  the  functioning  of  the  autopilot.  The  first  is  that 
there  is  no  indication  on  the  HUD  of  the  status  of  the 
autopilot.  The  second  problem  is  that  the  flight  controls 
cannot  control  the  aircraft  while  the  autopilot  is  engaged 
(i.e.,  no  override  capability).  In  addition,  the  pilot  must 
navigate  through  four  separate  menus  on  the  HDD  to 
deactivate  the  autopilot.  This  requires  approximately  7 
sec  on  average  to  accomplish.  The  third  problem  cited  is 
that  the  autopilot  functionality  does  not  fully  consider 
the  capabilities  of  the  aircraft,  which  results  in  the  com¬ 
manding  of  extreme  maneuvers  (unusual  attitudes)  and 
the  possible  overstressing  of  the  aircraft  by  the  autopilot. 
The  final  problem  is  that  the  autopilot  functionality  does 
not  conform  to  Air  Force  standards,  using  pitch  to  adjust 
airspeed  instead  of  power.  This  could  result  in  the  pilot 
not  being  fully  aware  of  what  changes  were  being  made 
by  the  autopilot  during  maneuvering. 


Figure  13.  Air  Force  Global  Hawk  (RQ-4). 


Global  Hawk 

The  Global  Hawk  (see  Figure  13),  made  by  Northrop 
Grumman,  is  the  largest  and  newest  of  the  five  military 
systems  discussed.  Global  Hawk  first  flew  in  February 
1998,  and  it  became  the  first  UA  to  cross  the  Pacific 
Ocean  in  April  200 1  when  it  flew  from  the  United  States 
to  Australia  (Schaefer,  2003). 

The  specifications  for  the  Global  Hawk  are  listed  in 
Table  7.  The  Global  Hawk  is  the  most  automated  of  all 
the  systems  discussed.  All  portions  of  the  flight,  includ¬ 
ing  landing  and  takeoff,  are  pre-programmed  before  the 
flight,  and  the  basic  task  of  the  crew  during  the  flight  is 
simply  to  monitor  the  status  of  the  aircraft  and  control 
the  payload.  While  this  makes  flying  the  Global  Hawk 
very  simple,  the  mission  planning  process  is  unwieldy 
and  requires  a  great  deal  of  time  to  accomplish. 

The  following  description  of  the  mission-planning 
process  for  the  Global  Hawk  is  taken  from  an  accident 
investigation  board  report  dated  February  2000: 

Mission  planning  is  a  long  and  involved  process  where 
everything  that  the  pilot  and  crew  of  a  manned  aircraft 
do  in  conjunction  with  a  mission  must  be  programmed 


Table  7.  Global  Hawk  specifications 
(from  Schaefer,  2003). 


RQ-4A 

Weight 

26,750  lbs 

Length 

44.4  ft 

Wingspan 

116.2  ft 

Ceiling 

65,000  ft 

Radius 

5,400  nm 

Endurance 

32  hrs 

Payload 

1,950  lbs 

Cruise  Speed 

345  kts 

Aircraft  Cost 

$20  M 

System  Cost 

$57  M 
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into  the  air  vehicle.  This  process  begins  up  to  270  days 
prior  to  flight  in  an  exercise  to  negotiate  agreement  on 
the  mission,  targets,  and  flight  routes.  Mission  planning 
involves  people  from  many  different  organizations.  Mis¬ 
sion  planners  become  actively  involved  90  days  prior  to 
the  flight.  Once  the  target  sets  are  finalized,  it  takes  three 
to  five  weeks  to  write  and  validate  a  mission  plan.  Mission 
plans  are  generated  using  a  mission  planning  system  that 
consists  of  the  standard  core  application  and  a  Global- 
Hawk-specific  module.  Validation  is  scheduled  to  take 
1 0  days,  starting  1 8  days  prior  to  the  planned  flight  and 
includes  any  iterations  necessary  to  finalize  the  plan. 

Only  three  accident  reports  were  available  for  the  Global 
Hawk.  Of  these  three  reports,  one  did  not  provide  suf¬ 
ficient  information  for  classification,  a  second  faulted  a 
failure  in  a  fuel  nozzle,  which  led  to  an  engine  failure, 
and  the  third  was  a  human  factors  issue  centering  on  the 
complicated  mission-planning  process.  In  that  accident, 
the  mishap  aircraft  suffered  an  inflight  problem  with 
temperature  regulation  of  the  avionics  compartment  and 
landed  at  a  preprogrammed  alternate  airport  for  servic¬ 
ing.  After  landing,  the  aircraft  was  commanded  to  begin 
taxiing.  Unknown  to  the  crew,  a  taxi  speed  of  155  knots 
had  been  inputted  into  the  mission  plan  at  that  particular 
waypoint  as  a  result  of  a  software  bug  in  the  automated 
mission  planning  software  in  use  at  the  time.  The  aircraft 
accelerated  to  the  point  it  was  unable  to  negotiate  a  turn 
and  ran  off  the  runway,  collapsing  the  nose  gear  and 
causing  extensive  damage  to  the  aircraft. 

An  analysis  of  human  factors  problems  with  the  Global 
Hawk  by  Tvaryanas  centers  primarily  on  the  high  levels 
of  automation  involved  with  the  system.  The  report 
suggests  that  system  operators  do  not  closely  monitor 
the  automated  mission-planning  software,  resulting  in 
lowered  levels  of  situation  awareness  and  a  lowered  ability 
to  deal  with  system  faults  when  they  occur.  In  particu¬ 
lar,  status  reports  were  difficult  to  interpret  because  they 
were  coded  in  hexadecimal  and  provided  no  trend  data 
to  the  operators. 


CONCLUSIONS 

Figure  14  summarizes  the  data  reported  in  this  report 
across  each  UA  system.  One  conclusion  apparent  from 
the  data  reported  here  is  that,  for  most  of  the  systems 
examined,  electrical  and  mechanical  reliability  play  as 
much  or  more  of  a  role  in  the  accidents  as  human  error. 
Mishaps  attributed  at  least  partially  to  aircraft  failures 
range  from  33%  (Global  Hawk)  to  67%  (Shadow)  in 
the  data  reported  here.  A  recent  report  by  the  Office 
of  the  Secretary  of  Defense  (Schaefer,  2003)  reviewed 
several  factors  affecting  the  electromechanical  reliability 
of  UA.  The  most  critical  factor  cited  is  that  cost  savings 
are  more  important  for  UA  than  for  manned  aircraft. 
Unfortunately  cost-saving  measures  have  a  tendency  to 
impact  component  reliability,  system  redundancy  and 
the  inclusion  of  new  component  technologies.  For  ex¬ 
ample,  cost-saving  techniques  such  as  the  use  of  wooden 
propellers  and  less  attention  to  watertight  sealing  leave 
some  UA  more  vulnerable  to  precipitation  than  manned 
aircraft.  In  addition,  the  relatively  smaller  size  of  many 
UA  also  has  an  adverse  effect  on  their  response  to  both 
precipitation  and  icing.  Schaefer  points  out  that  “a  one- 
tenth  inch  accumulation  [of  ice]  on  a  Pioneer’s  wings  is 
equal  to  one  inch  on  a  Boeing  747”  (p.  33). 

An  improvement  in  electromechanical  reliability  will 
probably  come  only  through  an  increase  in  the  cost  of  the 
aircraft.  However,  a  reduction  of  human  errors  leading 
to  accidents  might  not  necessarily  entail  increased  costs 
if  suggested  changes  can  be  incorporated  early  in  the 
design  process.  In  the  systems  analyzed,  human  factors 
issues  were  present  in  21%  (Shadow)  to  67%  (Predator) 
of  the  accidents.  These  numbers  suggest  there  is  room 
for  improvement  if  specific  human  factors  issues  can  be 
identified  and  addressed. 

In  that  regard,  it  is  important  to  note  that  many 
of  the  human  factors  issues  identified  are  very  much 
dependent  on  the  particular  systems  being  flown,  the 
type  of  automation  incorporated,  and  the  user  interface 


Maintenance  Human  Aircraft  Other 


Factors 


□  Hunter 

□  Shadow 

□  Pioneer 

□  Predator 

■  Giobai  Hawk 


Figure  14.  Summary  accident  percentages  across  aircraft  systems. 
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employed.  For  example,  both  the  Pioneer  and  Hunter 
systems  have  problems  associated  with  the  difficulty 
external  pilots  have  in  controlling  the  aircraft.  For  both 
of  these  systems,  the  majority  of  accidents  due  to  hu¬ 
man  error  can  be  attributed  to  this  problem.  However, 
the  other  three  systems  discussed  do  not  use  an  EP  and 
either  use  an  IP  (Predator)  or  perform  landings  using  an 
automated  system  (Shadow  and  Global  Hawk). 

Notably,  however,  the  use  of  automation  to  overcome 
human  frailties  does  not  completely  solve  the  problem, 
as  the  automation  itself  can  fail  (as  with  the  Shadow’s 
TALS)  and  the  automation  can  introduce  other  problems 
for  the  crew,  such  as  the  complicated  mission  planning 
process  required  for  the  Global  Hawk.  The  effectiveness 
of  automation  is  dependent  on  how  it  is  incorporated 
within  the  interface  (Parasuraman  &  Riley,  1997).  There 
are  current  research  efforts  to  understand  the  effect  that 
automation  has  on  UA  pilot/ operator  workload,  particu¬ 
larly  if  that  automation  is  not  completely  reliable  (Dixon 
&  Wickens,  2004;  Ruff,  Galhoun,  Draper,  Fontejon  & 
Guilfoos,  2004). 

The  design  of  the  user  interfaces  of  these  systems  are, 
for  the  most  part,  not  based  on  previously  established 
aviation  display  concepts.  Part  of  the  cause  for  this  is 
that  the  developers  of  these  system  interfaces  are  not 
primarily  aircraft  manufacturers.  Another  reason  is  that 
these  aircraft  are  not  “flown”  in  the  traditional  sense  of 
the  word.  Only  one  of  the  aircraft  reviewed  (Predator) 
has  a  pilot/ operator  interface  that  could  be  considered 
similar  to  a  manned  aircraft.  For  the  other  UA,  control 
of  the  aircraft  by  the  GGS  pilot/ operator  is  accomplished 
indirectly  through  the  use  of  menu  selections,  dedicated 
knobs,  or  preprogrammed  routes.  These  aircraft  are  not 
flown  but  “commanded.”  This  is  a  paradigm  shift  that 
must  be  understood  if  appropriate  decisions  are  to  be 
made  regarding  pilot/ operator  qualiflcations,  display 
requirements,  and  critical  human  factors  issues  to  be 
addressed. 

Besides  the  EP  accidents,  most  of  the  other  human 
factors-related  accidents  were  unique  in  the  sense  that  a 
problem  that  occurred  for  one  type  of  aircraft  would  never 
be  seen  for  another  because  the  user  interfaces  for  the 
aircraft  are  totally  different.  On  the  other  hand,  a  common 
theme  across  many  of  the  mishaps  reported  involved  a 
problem  with  the  command  interface  to  the  system.  The 
issues  reported  in  this  paper  regarding  alerts  and  alarms, 
display  design,  and  procedural  problems  are  mostly  as¬ 
sociated  with  providing  information  to  the  pilot/ operator 
about  the  commanded  status  of  the  aircraft. 


If  the  aircraft  is  commanded  to  begin  taxiing,  there 
should  be  information  available  regarding  the  intended 
taxi  speed.  If  the  aircraft  is  being  handed  off  from  one 
station  to  another,  the  receiving  station  personnel  should 
be  aware  of  what  commands  will  be  transmitted  to  the 
aircraft  after  control  is  established.  Interface  develop¬ 
ment  needs  to  be  focused  around  the  task  of  the  pilot/ 
operator.  For  most  of  these  aircraft,  that  task  is  one  of 
issuing  commands  and  verifying  that  those  commands 
are  accepted  and  followed.  Understanding  this  task  and 
creating  the  interface  to  support  it  should  help  to  improve 
the  usability  of  the  interface  and  reduce  the  number  of 
accidents  for  these  aircraft.  This  is  especially  important  as 
these  aircraft  begin  to  transition  to  the  National  Airspace 
System,  conducting  civilian  operations  in  among  civilian 
manned  aircraft. 
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